Behavioral malware clustering can be compromised by poisoning attacks.
problem Security of clustering algorithms for malware analysis.
method Investigated poisoning attacks on behavioral malware clustering.
result Behavioral malware clustering is vulnerable to poisoning attacks.
A new method clusters malware data more effectively.
problem Difficult clustering of drive-by-download malware data.
method Iterative data rescaling method to enhance cluster separation.
result Improved separation between malware clusters, higher silhouette width.
Introduces BWMD, a new distance measure for DNA and malware clustering.
problem Shortcomings of previous compression-based distance metrics.
method Embeds sequences into a fixed-length feature vector.
result Significantly improved clustering performance on larger malware corpora.
Detecting PE malware files is now commonly approached using statistical and machine learning models. While these models commonly use features extracted from the structure of PE files, we propose that icons from these files can also help better predict malware. We propose an innovative machine learning approach to extra…
Paper defends against malware detection attacks using clustering and deep learning.
problem Label flipping attacks on malware detection systems in IoT environments.
method Developed a Silhouette clustering-based attack mechanism and two CNN-type deep learning algorithms for defense.
result Proposed algorithms LSD and CSD improve malware detection accuracy by up to 19%.
Designs a classifier for malware detection using MDL principle.
problem Static malware detection in PE files.
method Clustering, closed frequent pattern mining, MDL principle for compression.
result Our classifier performs close to deep neural networks.
Bayesian context trees capture complex dependencies in categorical sequences.
problem Complex, long-range dependencies in categorical sequences are not well captured by simple models.
method Parsimonious Bayesian context trees with model-based agglomerative clustering for efficient inference.
result The proposed framework outperforms existing models on real-world data.
Effective and efficient mitigation of malware is a long-time endeavor in the information security community. The development of an anti-malware system that can counteract an unknown malware is a prolific activity that may benefit several sectors. We envision an intelligent anti-malware system that utilizes the power of…
PAD offers a principled approach to malware detection against evasion attacks.
problem Machine Learning techniques for malware detection are vulnerable to evasion attacks.
method PAD proposes a new adversarial training framework with convergence guarantees for robust optimization.
result PAD significantly outperforms state-of-the-art defenses and can harden ML-based malware detection against 27 evasion attacks.
Paper proposes a new model using Capsule Networks to classify malware types.
problem Classifying malware types with varying behaviors.
method Ensemble Capsule Network model using bootstrap aggregating.
result Improved accuracy in classifying malware types.
This paper presents a novel deep learning based method for automatic malware signature generation and classification. The method uses a deep belief network (DBN), implemented with a deep stack of denoising autoencoders, generating an invariant compact representation of the malware behavior. While conventional signature…
Malware authors have always been at an advantage of being able to adversarially test and augment their malicious code, before deploying the payload, using anti-malware products at their disposal. The anti-malware developers and threat experts, on the other hand, do not have such a privilege of tuning anti-malware produ…
I-MAD detects malware with high accuracy and interpretable results.
problem Detecting new malware samples and providing interpretable results.
method Galaxy Transformer network and interpretable feed-forward neural network.
result Significantly outperforms existing static malware detection models.
Research designs an AI system to classify malware under adversarial conditions.
problem Adversarial attacks on malware classification algorithms.
method Machine learning-based intelligent systems approach.
result Robust malware classification model under adversarial conditions.
Deep learning models misclassify malware with added benign features.
problem Detecting malware with deep learning when it's mixed with benign code.
method Trained a deep neural network classifier using benign and malware features. Demonstrated the impact of adding benign features to malware. Used data augmentation to improve classifier robustness.
result Adding benign features to malware significantly increases false negatives.
Transformer models improve malware classification, especially for imbalanced datasets.
problem Imbalanced multiclass malware classification.
method Bagging-based random transformer forest (RTF) ensemble of pre-trained transformer models (BERT or CANINE).
result Ensemble of pre-trained transformer models achieves state-of-the-art F1-score of 0.6149 on a benchmark dataset.
This work assesses the security of clustering algorithms against adversarial attacks.
problem The security of clustering algorithms in adversarial settings is questionable.
method Proposes a framework to identify and evaluate attacks on clustering algorithms.
result Attackers can significantly poison clustering processes with a small percentage of attack samples.
Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to a…
This paper analyzes CNNs for malware detection in cloud IaaS.
problem Malware vulnerability in cloud IaaS environments.
method Analysis of Convolutional Neural Networks (CNNs) for online malware detection using process-level performance metrics.
result State-of-the-art DenseNets and ResNets effectively detect malware in online cloud systems.
New method detects malware through obfuscation using adversarial risk analysis.
problem Insufficient malware detection in obfuscated binaries.
method Hybrid framework and adversarial risk analysis.
result Improved detection of malware through obfuscation.
MatchGNet detects malware by learning program behavior graphs.
problem Malware evasion through obfuscation and high false positives in traditional detection methods.
method Heterogeneous Graph Matching Network model that learns graph representation and similarity metrics.
result MatchGNet reduces false positives by 50% while maintaining zero false negatives.
Paper proposes a hierarchical approach to malware detection in cloud environments.
problem Malware threat in cloud computing environments.
method Machine learning on graphs, hypergraphs, and natural language for malware detection and analysis.
result Federated learning for malware detection in multicloud environments.
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
Survey on deep learning for malware classification, including unknown threats.
problem Classifying and recognizing unknown malware variants.
method Review of deep learning techniques and OSR solutions.
result Deep learning can effectively classify known malware and recognize unknown threats.
New unsupervised methods for anomaly detection and clustering in structured and streaming data.
problem Anomaly detection and clustering in structured and streaming data.
method Preference Isolation Forest (PIF), Sliding-PIF, MultiLink, Online-iForest, MaxLogit.
result Methods outperform existing techniques on synthetic and real datasets.
Study on adversarial examples and defenses for malware classification.
problem Vulnerability of neural networks to adversarial examples in malware classification.
method Analysis of different approaches for crafting adversarial examples and defense techniques in malware domain.
result Comparison of effectiveness of different approaches on multiple datasets.
Deep transfer learning improves malware classification speed and accuracy.
problem Static malware classification accuracy and speed.
method Transfer learning from computer vision to static malware detection.
result Our method outperforms classical machine learning methods in accuracy, false positive rate, true positive rate, and F1 score.
Study compares Android malware and benign apps using permissions.
problem Classify Android malware from benign apps.
method Used machine learning techniques like decision trees, random forests, SVM, etc.
result Permissions are a strong feature for malware detection.
New method tags malware for better understanding and identification.
problem Lack of detailed descriptions and relationships between malware samples.
method Deep learning model generates human-interpretable descriptions and similarity index.
result Correctly identifies more than 95% of eleven tag descriptions with a low false positive rate.
Project classifies malware using a multi-input LSTM model.
problem Classifying malware with high accuracy and handling class imbalance.
method Supervised multi-class LSTM model trained on annotated malware files.
result Multi-input model using both text and hexadecimal inputs outperformed single formats.
Deep learning improves Android malware detection.
problem Detecting and preventing Android malware.
method Review of static, dynamic, and hybrid deep learning approaches.
result Identifies strengths and weaknesses of deep learning methods.
New adversarial training enhances malware detectors against various attacks.
problem Vulnerability of malware detectors to evasion attacks.
method Proposes a mixture of attacks and adversarial training to improve deep neural networks.
result Significantly enhances robustness of deep neural networks against a wide range of attacks.
This paper explores adversarial examples in malware detection.
problem Malware detectors are vulnerable to adversarial interference.
method Training an existing model on a production-scale dataset to test adversarial attacks.
result Some previous attacks are less effective than initially reported.
GMM-HMMs improve malware classification compared to discrete HMMs.
problem Improving malware classification accuracy using GMM-HMM models.
method Used GMM-HMM models for opcode and entropy-based features comparison with discrete HMMs.
result GMM-HMMs generally improve significantly on entropy-based features classification results.
Building behavior profiles of Android applications (apps) with holistic, rich and multi-view information (e.g., incorporating several semantic views of an app such as API sequences, system calls, etc.) would help catering downstream analytics tasks such as app categorization, recommendation and malware analysis signifi…
It is needed to ensure the integrity of systems that process sensitive information and control many aspects of everyday life. We examine the use of machine learning algorithms to detect malware using the system calls generated by executables-alleviating attempts at obfuscation as the behavior is monitored rather than t…
DL-Droid detects Android malware using deep learning and real devices.
problem Sophisticated Android malware detection challenges traditional methods.
method Deep learning system with stateful input generation on real devices.
result DL-Droid achieves up to 99.6% detection rate with dynamic + static features.
Two novel dataset optimization strategies improve malware traffic detection accuracy.
problem Redundant and irrelevant information in network traffic datasets increases computational cost and noise.
method Feature selection and dimensional reduction techniques using mutual information and autoencoders.
result Optimized dataset leads to improved accuracy of Multi Layer Perceptron for malware detection.
Paper uses dynamic analysis to detect malware with PHMMs.
problem Malware detection using static and dynamic analysis techniques.
method Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs) trained on API call sequences.
result PHMMs outperform HMMs in malware detection.
HGConv uses HRR to efficiently detect malware, outperforming existing methods.
problem Efficiently detecting malware with long sequences.
method Holographic Global Convolutional Networks (HGConv) utilizing Holographic Reduced Representations (HRR).
result Achieved state-of-the-art results on malware benchmarks.
Detects malware-infected clients and malicious domains using transfer learning.
problem Detecting malware-infected computers and malicious web domains from encrypted HTTPS traffic.
method Transfer learning with sluice networks to bootstrap each other's detection models.
result Outperforms known reference models and detects previously unknown malware and domains.
Survey of machine learning methods for Windows malware classification.
problem Difficulties in malware classification through data collection, labeling, feature creation, and selection.
method Review of current methods and challenges in malware classification.
result Discussion of constraints and unaddressed problems for machine learning in cybersecurity.
Improved malware detection by adding auxiliary loss terms to a neural network.
problem Malware detection accuracy with a single label.
method Fit deep neural networks to multiple auxiliary prediction targets derived from metadata.
result Significant improvement in detection performance, reducing false negatives by 42.6% at a low false positive rate.
Adversarial machine learning in the context of image processing and related applications has received a large amount of attention. However, adversarial machine learning, especially adversarial deep learning, in the context of malware detection has received much less attention despite its apparent importance. In this pa…
Multi-scanner Antivirus systems provide insightful information on the nature of a suspect application; however there is often a lack of consensus and consistency between different Anti-Virus engines. In this article, we analyze more than 250 thousand malware signatures generated by 61 different Anti-Virus engines after…
Paper develops malware detection methods using Hamming distance.
problem Detecting and preventing spread of Android malware.
method Four detection methods using Hamming distance for similarity.
result Accuracy rates of proposed algorithms are more than 90%.
Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature lear…
Study evaluates predictive uncertainty in malware detection.
problem Detecting dataset shift and adversarial examples in malware detection.
method Re-designed and built 24 Android malware detectors, quantified their uncertainties with nine metrics.
result Predictive uncertainty helps reliable malware detection but not adversarial evasion attacks.